CVE-2022-38235

What it actually does

A segmentation violation occurs in DCTStream::getChar() at Stream.cc during processing of a malformed JPEG DCT stream, resulting in an application crash.

Why it matters to the business

PDF processing tools based on XPDF become unavailable when handling certain documents, interrupting document viewing and related workflows with no known fixed versions available.

How an attack unfolds

An attacker supplies a specially crafted PDF containing a malformed DCT stream; when the file is opened locally, the segmentation violation is triggered in DCTStream processing leading to denial of service.

How to fix it

Upgrade XPDF beyond commit ffaf11c once a corrective patch is released; in the interim isolate PDF processing to non-critical systems and avoid opening untrusted documents.

How to confirm the fix worked

Reproduce the crash with a test PDF containing the triggering DCT stream before and after any update; verify absence of the segfault in Stream.cc and confirm application stability.

Typical attack path

1. Craft a PDF file embedding a malformed JPEG DCT stream
2. Deliver the PDF to the target system via email, download, or file share
3. Victim opens the PDF using an affected XPDF-based viewer
4. DCTStream::getChar() dereferences invalid memory causing immediate crash

How to detect it

Review system and application logs for segmentation fault entries referencing xpdf or Stream.cc when PDF files are opened; correlate crashes with recent receipt of new PDF documents.

What your security team should do

• Block or sandbox untrusted PDF files from reaching XPDF instances
• Track upstream XPDF commits for a fix to the Stream.cc segmentation violation
• Prefer alternative hardened PDF viewers until remediation is confirmed